CVE-2026-123575

NameCVE-2026-123575
DescriptionHickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or limits for incomplete request bodies. Remote attackers can open DoH connections, send incomplete request bodies, and hold connections open to exhaust server memory.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rust-hickory-dns (PTS)trixie0.24.4-1vulnerable
forky, sid0.26.3-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
rust-hickory-dnssource(unstable)0.26.3-1

Notes

https://github.com/hickory-dns/hickory-dns/security/advisories/GHSA-g5xf-qv55-wv37
Search for package or bug name: Reporting problems